From ee6589ff520620aa4d35f830f0a06a8a4f373435 Mon Sep 17 00:00:00 2001 From: Sahil Lenka Date: Thu, 1 Oct 2026 11:44:51 +0530 Subject: [PATCH] fix: skip affected packages for "Not affected" Arch Linux AVGs The Arch importer never looked at the AVG status, so records marked "Not affected" were imported as affecting the listed packages. For example AVG-2737 showed gnome-remote-desktop 42.1-1 as affected. Keep the advisory so its aliases and references are still recorded, but do not attach any affected packages to it. Signed-off-by: Sahil Lenka --- .../v2_importers/archlinux_importer.py | 6 +++++- .../v2_importers/test_archlinux_importer_v2.py | 17 +++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/vulnerabilities/pipelines/v2_importers/archlinux_importer.py b/vulnerabilities/pipelines/v2_importers/archlinux_importer.py index 35f620e77..4c9953c6d 100644 --- a/vulnerabilities/pipelines/v2_importers/archlinux_importer.py +++ b/vulnerabilities/pipelines/v2_importers/archlinux_importer.py @@ -65,7 +65,11 @@ def parse_advisory(self, record) -> AdvisoryDataV2: summary = record.get("type", "") summary = "" if summary == "unknown" else summary - for name in record["packages"]: + packages = record["packages"] + if record.get("status") == "Not affected": + packages = [] + + for name in packages: affected = record.get("affected") fixed = record.get("fixed") diff --git a/vulnerabilities/tests/pipelines/v2_importers/test_archlinux_importer_v2.py b/vulnerabilities/tests/pipelines/v2_importers/test_archlinux_importer_v2.py index 20a578a31..85d0bbef1 100644 --- a/vulnerabilities/tests/pipelines/v2_importers/test_archlinux_importer_v2.py +++ b/vulnerabilities/tests/pipelines/v2_importers/test_archlinux_importer_v2.py @@ -28,3 +28,20 @@ def test_to_archlinux_advisories_v2(self): pipeline.response = data result = [adv.to_dict() for adv in pipeline.collect_advisories()] util_tests.check_results_against_json(result, expected_file) + + def test_not_affected_avg_has_no_affected_packages(self): + record = { + "name": "AVG-2737", + "packages": ["gnome-remote-desktop"], + "status": "Not affected", + "severity": "Unknown", + "type": "unknown", + "affected": "42.1-1", + "fixed": "42.1.1-1", + "ticket": None, + "issues": ["CVE-2022-1736"], + "advisories": [], + } + advisory = ArchLinuxImporterPipeline().parse_advisory(record) + self.assertEqual(advisory.affected_packages, []) + self.assertEqual(advisory.aliases, ["CVE-2022-1736"])